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Process execution control module of file forwarding system of distributed 
information processing system - initiates process controller of reception 
side file forwarding apparatus, to make process execution vinit to execute 
processes according to acquired information, when file is received from 
transmission side system 

Patent Assignee: NEC CORP (NIDE ) 

Number of Countries: 001 Number of Patents: 001 

Pauenc Family: 

•■'V.t^'r.* Nc Kind Date Applicat No Kind Date Week 

'i -23052 A 19991130 JP 98152229 A 19980514 200007 B 

!•:. ■oriLy Applications (No Type Date): JP 98152229 A 19980514 
Pacenc Details: 

Patent No Kind Lan Pg Main IPC Filing Notes 
JP 11328052 A 9 G06F-013/00 

Abstract (Basic) : JP 11328052 A 

NOVELTY - The information about the processes to be performed are 
stored in memory (28) of the reception side file forwarding apparatus. 
When the file is received from transmission side system, a process 
controller (32) is initiated, for making process execution unit (30) to 
execute the processes according to the information acquired from the 
memory. DETAILED DESCRIPTION - A memory (20) of transmission side file 
forwarding apparatus, stores the information relevant to the processes 
to be performed. A process controller (24) is initiated to make the 
process execution unit (22) to execute the processes according to the 
information acquired from the memory (20) . A transmitter (26) is 
provided for forwarding the file to the reception side system. 

USE - For controlling process execution in file forwarding system 
of distributed information processing system. 

ADVANTAGE - The file encryption, compression of file or detection 
of computer virus can be performed automatically during file 
transmission and reception, as the corresponding protocol process 
concrol information are stored beforehand in the memory of respective 

i rie file forwarding apparatus. Thus transmission of information is 
= -.c.r.;-:-K: Mexibly and efficiently. DESCRIPTION OF DRAWING(S) - The 
: . ;jre shows block diagram of distributed information processing system 
ri',:v!,ng Tile forwarding apparatus. (20,28) Memories; (22, 30) Process 
execucion units; (24,32) Process controllers; (26) Transmitter. 
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Virus checking network for multimedia communication, Internet - detects 
virus affected packet based on virus pattern stored in memory and 



transmits bit indicat^Bg infection of packet to client^Hde so that 

corresponding file is not executed 
Patent Assignee: FUJITSU LTD (FUIT ) 
Number of Countries: 001 Number of Patents: 001 
Patent Family: 

Patent No Kind Date Applicat No Kind Date Week 
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Abstract (Basic): JP 11167487 A 

NOVELTY - A virus check unit (12) checks for an infected packet 
(Pa) by observing header, based on virus pattern stored in memory (11) 
in the network side. The bit (Pb) denoting infection of packet, is then 
transmitted towards client terminal. DETAILED DESCRIPTION - A detector 
(21) in client side detects infected packets, and a file execution 
control unit (22) prevents execution of file corresponding to 
infected packet. The virus pattern information is distributed through 
network by pattern distributing unit (31) . A virus pattern management 
unit (32) performs single element management of virus pattern 
controlled by administration bureau (30) . 

USE - For detecting virus in internet, multimedia. 

ADVANTAGE - Since virus is detected in network side, virus 
infection and magnification is prevented. DESCRIPTION OF DRAWING(S) - 
The figure shows the block diagram of virus check network. (11) Memory; 
(12) Virus check unit; (21) Detector ; (22) File execution control 
unit; (30) Administration bureau; (31) Pattern distributing unit; (Pa) 
Infected packet; (Pb) Bit. 
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Virus existence indication device for network connected computer - 
notifies user of existence of virus when file forwarding program 
detects virus in data received by substitute function from socket 
module 
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Patent Details: 
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Abstract (Basic) : JP 11119991 A 

NOVELTY - A hook (4) seizes a call of a socket module (2) from an 
application and posses the corresponding data to a substitute 
function (5) . When a file forwarding program (1) detects existence of 
virus in the received data in the substitute function, a notification 



unit (10) notifies ^pi^r of a virus. 

USE - For use during file forwarding in network connected in 
computer . 

ADVANTAGE - Avoids unnecessary operation by user as virus existence 
is notified to user automatically thus safety of computer is secured. 
OESCRIPTION OF DRAWING (S) - The figure shows the block diagram of a 
aucomatic virus existence indication device. (1) File forwarding 
program; (2) Socket module; (4) Hook; (5) Substitute function; (10) 
Notification unit. 
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A software program or agent used in conjunction with anti- virus 
software to detect and remove computer viruses that may be present 
in electronic mail attachments - provides an interface between the 
message system of a network server and an anti-virus application 
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Patent Details: 

Patent No Kind Lan Pg Main IPC Filing Notes 
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Based on patent WO 9810342 
RU 2221269 C2 G06F-007/02 Based on patent WO 9810342 

ES 2199372 T3 G06F-007/02 Based on patent EP 1010059 

Abstract (Basic) : WO 9810342 A 

A database (140) is used to store all e-mail (electronic mail) 
messages and their associated file attachments, and together with 
the mail server (130) comprise a message system. 

The software program or agent (110) scans the attachments to all 
e-mail messages handled by the mail server. The agent detaches and 
forwards any message attachments to an anti- virus application (120) 
which scans files for viruses and removes them from an infected 
:'':1g. The file is then re-attached to its message by the agent. 

The agent can scan both on a real-time basis and at pre-set 
inLervais. All e-mail messages are scanned. 

ADVANTAGE - No need to be installed at every workstation due to 
cencralised scanning from a server, does not cause any detriment to the 
e-mail attachment, and is applicable to all types of e-mail messages 
including draft /stored . 
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Virus checking method for computer word processing application - 
deactivating execution of automatic instruction sequences associated 
with opened file , and detecting and examining instruction sequences at 
file operation 
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DE 19638143 Al 4 G06F-012/16 

Abstract (Basic) : DE 19638143 A 

The method includes the steps starting a data processing 
application and deactivating an execution of automatic instruction 
sequences which may be associated with the file . A check or a query 
on the existence of such associated instruction sequences is performed 
at a file operation. 

At detecting such sequence, a message is generated, which requests 
the execution of an instruction fro processing the detected instruction 
sequence. The instruction sequence is processed, and depended on the 
result of the processing, the sequence may be deleted or executed by 
removing the deactivation. 

USE - Esp. for detecting macro- virus in word editor, e.g. 
WinWord, Excel, Windows applications. 

ADVANTAGE - Improves protection against viruses implemented as 
word-processor macros. 
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Polymorphic virus detection in computer file using mutation-engine 
specific data for known polymorphic viruses - repeatedly determining 
if instruction is used in virus decryption loop, tagging memory 
location associated with instruction and scanning tagged locations for 

r js signatures when emulated instruction is not used in virus 
decryption loop 
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Abstract (Basic): WO 9712322 A 

An instruction is fetched from a computer file. Next it is 
determined whether the instruction is used in decryption loops 
generated by known polymorphic viruses identified in a list. When 
the instruction is used in decryption loops generated by known 
polymorphic viruses, a memory location associated with the instruction 
is tagged and the fetching and determining steps are repeated. 

The method further involves scanning the tagged locations for 
virus signatures when the emulated instruction is not used in 
decryption loops generated by known polymorphic viruses. 

ADVANTAGE - Detection system can be readily expanded to cover newly 
discovered viruses without need for extensive regression testing 
and modification of heuristics of emulation control module. 
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Abscracc (Basic) : JP 8063352 A 

The system detects the virus program residing in a specific 



file . An unidirec^PJnal relation calculation part ^R7) computes the 
relation using which the virus program counter is converted. A transfer 
part transfers the conversion result and a registration part stores the 
result . 

The transfer part is an integral unit of the end system (101). A 
central management (105) furnished with a collation part, detects 
wh.euher the transferred result and the result from the relation 
:'j . v'j i a i: ion pare, agrees. 

A[>VANTAGE - Performs virus check efficiently. Obtains result with 
r.iqh reliability. Obtains virus check result, automatically. 
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Abstract (Basic) : EP 636977 A 

The behaviour analysing anti- virus program detects viral 
infection of a target program by emulating the execution of the program 
and analysing the emulated execution. The anti-virus monitor program 
contains both variables corresp to the CPUs registers and emulation 
procedures corresp to the CPUs instructions. The target program is 
loaded into memory and its execution is emulated by the anti-virus 
monitor program. 

Intelligent procedures contained within the monitor program are 
Given control between every instruction emulated so as to detect 
aberrant or dangerous behaviour in the target program in which case the 
danger of viral presence is flagged and emulation is terminated. 

USE/ADVANTAGE - Emulating execution of program on computer system 
to detect harmful or dangerous behaviour in program e.g computer 
viruses . 
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Based on patent EP 514815 



Abstract (Basic) : EP 514815 A 

A computer program that has been infected by a computer virus can 
be recovered by use of a fingerprint. Prior to the program being 
infected the program is examined and a fingerprint of the program is 
taken along with initial data from the beginning of the program. 

The fingerprint and beginning data is stored in a separate area 
from the program and a backup version of the original program is also 
stored. When the program is called a check is made on the original and 
stored program fingerprints and in case of deviation the stored program 
is restored. 

USE - Computer program security and detection of virus . 
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...CLAIMS a simulated manner; and 

3 detection module (17), coupled to said emulator, and operable to 
detect the presence of macro viruses based upon a preselected 
decision criterion on the behaviour of the macros, and information 
provided . . . 

...of claifn 1 further comprising: 

coupled CO said detection module, a repair module (19) for eliminating 

macro viruses detected by said detection module. 

3. A method for detecting the presence of macro viruses within a 

digital computer (1), said method comprising the steps of: 
associating an application program (5) with said digital computer; 

associating a global environment (13) with said application program; 
causing said application program to generate at... 

...behaviour of the macros. 

4. The method of claim 3, further comprising the step of deleting a 

macro virus when said macro virus is deemed to be present. 

5. The method of claim 3... 
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...ABSTRACT a system and method for automatically generating at least one 
i.nstance of a computer macro virus that is native to or associated 
with an application . The method includes steps of (a) providing a 
suspect virus sample; and (b) replicating the suspect virus sample onto 
a least one goat file, using... 

...additional instance of an infected goat file. The step of providing 
includes a step of determining attributes of the suspect virus 
sample, and the steps of exercising employ simulated user input or 
interprocess communication commands that... 

CLAIMS 1. A method for automatically generating at least one instance of a 
computer macro virus associated with an application , comprising 
steps of : 

crovLding a suspect virus sample; and 

: --p: icaiiing the suspect virus sample onto a least one goat file, using 
at least one of simulated user input.., 

. . .A method as in claim 2, wherein the step of providing includes a step of 
determining attributes of the suspect virus sample, and wherein 
the steps of exercising use simulated user input or interprocess 
communication commands... 
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. . .ABSTRACT A2 

A behavior analyzing antivirus program detects viral infection of 
a target program by emulating the execution of the target program and 
analyzing the emulated execution to detect viral behavior. The 
antivirus monitor program contains both variables corresponding to 
the CPU's registers and emulation procedures corresponding to the CPU's 
instructions. The target program is loaded into memory and its execution 
is emulated by the antivirus monitor program. Intelligent procedures 
contained in the monitor program are given control between every 
instruction . . . 



. . . CLAIMS detected . 

. The computer system of claim 1, wherein said computer system is 
configured to detect a computer virus associated with said 
target program , wherein said predetermined behavior is chosen to be 
indicative of replication of said computer virus . 
3. The computer system of claim 1 wherein said instruction emulation 
means comprises: 

a register. . . 
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. . . of Che examined characteristics and behaviors, the assigned weights 
indicative of a valid program or malicious code as a function of the 
detection 

routines; and 

determining whether executable code under investigation is malicious code 
as a function 
of. . . 

...detection routines. 

22 The method of claim 21, wherein the detection routines include valid 
program detection routines and malicious code detection routines. 

23 The method of claim 21, wherein the valid program detection routines 
detennine whether the executable code under investigation exhibits at 
least one or more characteristics and 

behaviors associated with a valid program; and 

wherein the malicious code detection routines determine whether 
the executable code under investigation exhibits at least one or more 
characteristics and behaviors... 

. . . weights . 

25 The method of claim 24, wherein scoring includes using a scoring 
algorithm for identifying executable code as malicious code in 
: --^^sponse no at least one of a valid score and a malicious code score... 

Che examined characteristics and behaviors, the assigned weights 
•:.c:icacive of a valid program or malicious code as a function of the 
detection routines; 
and 

determine whether executable code un ' --ivestigation is malicious code as 
a f unct ion of . . . 

. . . weights . 

50 The computer program of claim 49, wherein the detection routines 
include valid 

program detection routines and malicious code detection routines. 



51 The computer program of 
routines determine whether 



claim 49, wherein the valid program detection 
the executable code under investigation 



exhibits at least one ^^more 

characteristics and behaviors associated with a valid program; and 
wherein the malicious code detection routines determine whether 
the executable code under investigation exhibits at least one or more 
characteristics and behaviors... 
...53 The computer program of claim 52, wherein scoring includes using a 
scoring algorithm for identifying executable code as malicious code 
in response to at least one of a valid 
score and a malicious code score. . . 

...of the examined characteristics and behaviors, the assigned weights 
indicative of a valid program or malicious code as a function of the 

detection routines; and 
determine whether executable code under investigation is malicious code 
as a function of... 

. ..7S The information handling system of claim 11, wherein the detection 
r 'j! ::ies include valid program detection routines and malicious code 
detection routines. 

'.J The information handling system of claim 11, wherein the valid program 
deteccion routines... 

...whether the executable code under investigation exhibits at least one or 
more characteristics and behaviors associated with a valid program; and 
wherein the malicious code detection routines determine whether 
the executable code under investigation exhibits at least one or more 
characteristics and behaviors... 

...The information handling system of claim 80, wherein scoring includes 
using a scoring algorithm for identifying executable c{ * - s 
malicious code in response to a valid score and a malicious code 
score . 

82 The information handling... 
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. . . disk usage information, determining whether a particular file is 
present, determining whether at least one file of a particular type 
is present, determining billing for storage usage, detecting a virus 
-infected file, identifying an illegal file, identifying a breach of a 
policy that defines standardized storage locations for... 
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English Abstract 

...manual operation by a user. In a computer communication device 
installed, there is prepared an anti -virus program having a function to 
detect existence of a particular computer virus , a function to 
exterminate the computer virus , and a function to have an infection 
ability identical or substantially identical to the particular... 

...infection ability and transmit its clone to another computer 
communication device when the particular computer virus is 
exterminated . An anti - virus program is installed in at least one 
computer communication device connected to a communication network and 
infected with a particular computer virus . Through the infection route 
of the particular computer virus , the anti - virus program clone 
is distributed to infect the other computer communication devices one 
after another (ST3, ST4 ) . 
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Claim 

and distributes said task information among each of said pattern 
matching circuits. 

4 A computer virus check device according to claim 1, wherein, when 
there are two or more of said pattern... 

...and distributes the divided file among each of said pattern matching 

circuits . 

A coiiiputer virus check device according to claim 1, wherein, when 
here are two or more of said pattern pattern data Gorresponding to the 
file among each of said pattern matching circuits. 

6 A computer virus check device according to claim 1, further 
comprising a network interface 
1 9 

circuit including a... 



...a PHY (Physical Layer). 

7 A semiconductor integrated circuit having any one of the computer 
virus check devices according to claims 1 to 6 integrated into a 
single chip. 

8 A computer comprising two or more of a computer virus check device 
comprising: a task queue memory for receiving and saving file information 
uniquely specifying a... 
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English Abstract 

A method for restoring a computer system modified by malicious code. The 
method scans the computer system for the malicious code , 
identifies the malicious code and retrieves from a data file , 
: riiorma L ion relating to the malicious code including at least one 
command used for restoring the computer system to a state that... 

Claim 

... restoring a computer system modified by malicious code, comprising: 
scaniiing the computer system for the malicious code ; 

identifying the malicious code ; 
retrieving from a data file , information relating to the malicious 
code including at least one command used for restoring the computer 
system to a state that... of claim 1^ wherein the data file comprises a 
plurality of data files, each data file being provided for a 
particular type of malicious code , each ...computer executable code 
for restoring a computer system 
modified by malicious code, comprising: 

code for scanning the computer system for the malicious code ; 
code for identifying the malicious code ; 

oode for retrieving from a data file , information relating to the 
malicious code including at least one command used for restoring the 
computer system to a state that... of claim 6, wherein the data file 
comprises a plurality of data files, each data file being provided for 
a particular type of malicious code , each data file including at 
least one command that can be used for restoring the . . . f or restoring a 
computer system modified by malicious code, comprising: a data signal 
portion for scanning the computer system for the malicious code ; 
a data signal portion for identifying the malicious code ; 
a data signal portion for retrieving from a data file , information 
relating CO the malicious code including at least one command used 



for restoring the complBfr system to a state that . . . claB^l 1, wherein 
the data file comprises a plurality of data files, each data file being 
provided for a particular type of malicious code , each data file 
including at least one conu-nand that can be used for restoring code, 
comprising : 

means for scanning the computer system for the malicious code ; 
means for identifying the malicious code ; 

means for retrieving from a data file , information relating to the 
malicious code including at least one command used for restoring the 
computer system to a state that... 
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rnq I i. sh Abstract 

A hod or managing a virus signature database associated with an 
anti - virus application , both of which are resident in a memory of a 
■ 1 wireless device 2,-1... 



...A. In accordance with instructions 
iridividual signature entries of the 
deleted or replaced, and new signat 



contained in the management messages, 

virus signature database are 
ures added. 



Claim 

1 A method of managing a virus signature database associated with an 
anti - virus application , both of which are resident in a memory of a 
computer device, the method comprising... 



.and comprising 

receiving management messages over the wireless interface, the management 
messages containing respective add, delete , or replace virus 
signature instructions. 



4 A method according to claim 3, wherein in the case of an. 




...communicate with a cellular telecommunications network. 

9 A computer device having a memory and an anti - virus software 
application resident in the memory, the memory also containing an anti - 
virus signature database accessible in use by the anti - virus 
application, the apparatus comprising processing means for adding, 
deleting, and/or replacing individual signature entries... 

...wherein the computer device is a mobile wireless device. 

11 A method of managing a virus signature database associated with an 

anti - virus , application , both of which are resident in a memory of 
a mobile wireless device, the method comprising receiving management 
nessaqes, relating to dacabase or anti - virus application changes, 
1* "he device, che management messages being filtered either at the 
' : i : n s ide of. . . 
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Claim 

... accessible to said browser: 

creating an instance of a browser plugin, said plugin providing a virus 
scanning 

function or providing a route to a virus scanning function; 

scanning the data for viruses using the instance of the plugin; 
if no viruses are detected in the data, returning the data to the 
browser for 

1 0 rendering; and 

if a virus is detected in the data, inhibiting rendering of the data. 

2 A method according to claim 1 , . . 



.4 A method according to any one of the preceding claims, wherein the 



plugin comprise virus^^scanning functionality. 



5 A method according to any one of claims I to 3, wherein the instance of 
the plugin created by the browser causes a separate virus scanning 
application to be opened, and the plugin makes the data accessible to the 
scanning application.., 

.mobile wireless device comprising a memory having a WAP browser 
cippiication stored therein and a virus scanning browser plugin, 
wherein in use the WAP browser creates an instance of the virus 
scanning plugin for scanning WAP data prior to rendering the data. 

A mobile wireless device comprising a memory. . . 
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CI Bim 

... in claim 1, wherein said system is configured, in the 0 event of a 
known virus being detected , to use relational data process to invoke 
the known- virus verification and removal process for the specific 
virus detected . 

8 The computer system in claim 1, wherein said system is configured in 
any one . . . 
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Kn-jlish Abstract 

...uhe integrity of the file to be verified at any time and is used to 
detect viruses or corrupted or tampered files at startup and also 
during runtimes of the file and its associated application . The 
operating system will store the new file length in a file allocation 
table and. . . 
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English Abstract 

Apparatus and method for detecting the presence of macro viruses 
within a digital computer (1). An application program (5) is 
associated with the digital computer (1). A global environment (13) is 
associated with the application program. . . 

Claim 
Claims 

1 Apparatus for detecting macro viruses, said apparatus 

:o[np rising : 

a ciigital computer having at least one storage device; 
in application program associated with said computer; 
a global environment associated with said application 
I 0 program; 
at least . . . 

...apparatus of claim 1 further comprising: 

coupled to said emulator, a detection module adapted 

to detect the presence of macro viruses based upon a preselected 
20 decision criterion and based upon information provided by said 
emulator . . . 

...apparatus of claim 2 further comprising: 

coupled to said detection module, a repair module for 

eliminating macro viruses detected by said detection module. 
4 A method for detecting the presence of macro viruses 
within a digital computer, said method comprising the steps of: 

associating an application program with said digital 
computer; 
15 

associating a global environment with said application 
program ; 




..deemed to be present. 



5 The method of claim 4 further comprising the step of 

deleting a macro virus when said macro virus is deemed to be 
present . 
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English Abstract 

The iterative detection and treatment of viruses using virus detection 
objects and virus treatment objects is disclosed. Pursuant to a request 
for a virus scan, a virus detection object is produced by a server (400) 
and is transmitted to a client (300A, B) for execution. The client (300A, 
B) receives and executes the virus detection object, and the results are 
transmitted to the server (400) . The server (400) uses the results to 
produce an additional virus detection object which is also transmitted to 
the client (300A, B) and executed so that the results can be transmitted 
to the server (400) . The iterative production and execution of virus 
^ierect.ion objects is continued until a determination is made as to 
wr. turner the targeted file or data includes a virus. Upon a determination 

a !:arqeted file or data includes a virus, a vaccine specifically 
- ii'ored to the conditions presented at the client (300A, B) and the type 
oi. virus detected is produced, preferably in the form of a virus 
treatment object. The request for a virus scan can be directly made or 
indirectly by a triggering event. One virus detection server (400) 
embodiment includes a virus information expert system that applies 
conditional data to predetermined knowledge about virus scanning to make 
determinations such as when to scan for viruses. A network diagnosis and 
treatment application includes a diagnostic data module, an expert 
system, and a maintenance requesting module. The expert system applies 
the diagnostic data to predetermined knowledge about the diagnosis and 
maintenance of a network to make determinations upon which maintenance 
requests are made. Preferably, the expert system includes a virus 
in [formation expert system. 

French Abstract 

Detection iterative et traitement de virus au moyen d'objets de 
detection de virus et d'objets de traitement de virus. Suite a une 
demande de recherche de virus, un objet de detection de virus est produit 
par un serveur (400) et transmis a un client (300A, B) pour execution. Le 
client (300A, B) recoit et execute 1' objet de detection de virus et les 
resultats sont transmis au serveur (400). Le serveur (400) utilise ces 
resultats pour produire un objet de detection de virus complementaire qui 
est egalement transmis au client (300A, B) et execute de sorte que les 



resultats sont transmis au serveur (400). La production * execution 

iterative d^objets de detection de virus est poursuivie jusqu'a 
determination de la presence, le cas echeant, d'un virus dans le fichier 
ou dans les donnees cibles. S'il est determinee que le fichier ou les 
donnees cibles contiennent un virus, un vaccin specialement adapte aux 
conditions relevees chez le client (300A, B) et au type de virus detecte 
est produit, de preference sous forme d'un objet de traitement de virus. 
La demande de recherche de virus peut etre formulee directement ou 
indirectement par un evenement declenchant. Dans un mode de realisation, 
serveur (400) de detection de virus comprend un systeme expert 
i D forma t ion sur les virus qui applique les donnees conditionnelles a 
'u-s v:onnaissances predeterminees relatives a la recherche de virus pour 
. ie*: er.miner notarmnent quand rechercher les virus. Une application pour le 
diagnostic et le traitement d'un reseau comporte un module de donnees de 
diagnostic, un systeme expert et un module de demande de mise a jour. Le 
systeme expert applique les donnees de diagnostic aux connaissances 
predeterminees relatives au diagnostic et a I'entretien d'un reseau pour 
etablir des conclusions sur la base desquelles des demandes d'entretien 
sont formulees. Le systeme expert comprend de preference un systeme 
expert d ' information sur les virus. 

Main International Patent Class: G06F-011/00 
International Patent Class: G06F-11:22 
Full text Availability: 
Detailed Description 

Detailed Description 

scan is initiated without a request that it apparent to the user. 

Once it is determined by the virus detection server that a valid virus 
detection request has been received, the... 

...conditions presented at the client, including the specific type of virus 
that was detected. The virus detection server receives the results 
produced by the execution of one. or more virus. detection objects 
andiises the results to tailor the vaccine. For example, the result may 
i[.::\rav.e cha c system administrator. Specifically, events that regularly 

::. h- ::sed to trigger a request for virus scanning by the 
virus detection server. 



A;': embodiment of the virus detection server includes various modules 

Lor 

Che iterative detection and treatment of computer viruses . An 
iterative virus detection module includes a scanning module, a 
virus pattern module, a virus rules module, a cleaning module, a 
cleaning pattern module, an access... can be used for the browser 330 and 
to provide the executable portions of the virus detection 
objects. For example, the browser 330 could be the Netscape Navigator as 
provided by . . . 

...objects produced by the virus detection server 400, such as via an 
enabled browser 330, viruses can be detected and treated at the 
client 300 using the virus detection server 400. 

Since viruses can be detected and treated at the client 300 using the 

virus detection server 4 00 using the enabled browser 330 {or other 
means to execute the virus detection objects), viruses can be 
detected and treated without the virus detection shell 332. 

However, although the virus detection shell 332 is optional, it can 
alternatively be provided in memory 314 for various purposes ... configured 
to acquire the necessary information. 

Ancer it is determined that a valid request for scanning has been 
provided, virus detection objects are iteratively produced and 
r. ransmi t ced to the requester, such as a client 300, in order to detect a 
virus . The scanning module 454 includes various routines that can be 
used in the detection of viruses . Preferably, the routines are 




provided for separate access so that virus detection ^^ects can be 

cailored to include selected scanning routines. For example, separate 
rouiiines for the detection of viruses that could reside in systems 
j.sinq particular platforms and operating systems, in particular file 

* yi^s . . . 

-locacions are provided for separate access in the scanning module 454. 
Specifically, routines for the detection of viruses that typically 
reside on one platform are provided such that they can be accessed 
separate from routines for the detection of viruses that typically 
reside on another platform. Similarly, routines for the detection of 
viruses that reside in "executable" files (such as those that have the 
file extension .exe) are provided such that they can be accessed separate 
from routines used for the detection of macro viruses (such as those 
that implement the WordBasic programming language, typically reside in 
application data files... 

.in the scanning module are configured to use the particular programming 
tools used by the virus detection server 400 to detect viruses at the 
client 300. Thus, the routines are capable... to Fig. 5. 
Conventional indexing and sorting techniques can be used to tag the 
various virus scanning routines provided in the scanning module 4 54 
and, accordingly, to facilitate separate access. 

Similar to the scanning module 454, the virus pattern module 456 and 
virus rules module 458 respectively include virus signatures and rules 
that can be used in the detection of viruses . As with the routines 
described in connection with the scanning module 454, the patterns and 
rules are provided to facilitate separate access. Thus, for example, the 
file signatures in the virus pattern module 456 corresponding to one 
rype oi file can be separated from the virus signatures 
corresponding to a second file type. Similarly, the rules in the 
virus rules module 4 58 corresponding to one detection criteria can be 
separated from the virus rules... 
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31 355481 VIRUS?? OR VIRII OR VIRAL OR MACROVIRUS?? OR TROJAN () HORSE- 
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SIGNAL? ? OR INSTRUCTION? ?) 
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OR FILE? ? OR FILETYPE? ?) 

36 947379 (SPECIFIC OR PARTICULAR OR CORRESPOND? OR CORRELAT? OR ASS- 
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ROCESSES OR THREAD? ? OR PROGRAM? ? OR APPLICATION? ? OR FILE? 
? OR FILETYPE? ?) 
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66 Sll NOT PD>20000531 
* 3501 32:34 (100N)S6 

514 256253 (SPECIFIC OR PARTICULAR) ( 7W) ( PROCESS OR PROCESSES OR THREA- 

D? ? OR PROGRAM? ? OR APPLICATION? ? OR FILE? ? OR FILETYPE? - 
?) 

515 1266 S2:S4 (100N}S14 

516 899 S1(10N)S14 

317 402 S2:S4 (lOON) 316 

S18 4364 (CORRESPOND? OR CORRELAT? OR ASSOCIAT? OR REFER??? OR RELA- 

TE? ? OR RELATING) {7W)S14 



S19 18 S2:S4 (100N)S18 

^20 10 4 RD (unique items) 



20/3, K/1 (Item 1 from file: 621) 

:::AL0G(R) File 621:Gale Group New Prod . Annou . ( R) 
(c) 2004 The Gale Group. All rts. reserv. 

03647944 Supplier Number: 113806646 (USE FORMAT 7 FOR FULLTEXT) 
U.S. Environmental Protection Agency Awards NanoBio (R) Contract For 
Development of Anthrax Decontamination Product. 

PR Newswire, pNA 
March 2, 2004 

Language: English Record Type: Fulltext 
Document Type: Newswire; Trade 
Word Count : 4 51 

NanoProtect ' s development plan will result in a safe bio-decontaminant 
chat kills bacteria, viruses , spores and fungi while being uniquely 
non-toxic to humans or the environment. The EPA's specific interest 
relates to their Safe Buildings Program where NanoProtect would be used 
by first responders in the event of a bio-attack. . . 




20/3, K/2 (Item 2 from file: 621) 

DIALOG (R) File 621:Gale Group New Prod , Annou .( R) 
(c) 2004 The Gale Group. All rts. reserv. 

' :i:"3376 Supplier Number: 42689669 (USE FORMAT 7 FOR FULLTEXT) 
VERTEX PHARMACEUTICALS RECEIVES NATIONAL SCIENCE FOUNDATION GRANT TO 
DEVELOP NOVEL ENZYME TECHNOLOGY 

PR Newswire, pi 
Jan 23, 1992 

Language: English Record Type: Fulltext 
Document Type: Newswire; Trade 
Word Count: 397 

. . . through which 

synthetic compounds are designed at the atomic level to interact with 
protein targets associated with particular disease processes 

. Vertex 

applies this approach, involving the integration of advanced biology, 
chemistry, and biophysics to create... 

...drugs to treat major diseases. The company is focusing on three major 
therapeutic areas: immunology, anti viral chemotherapy, and 
inflammation . 

CONTACT: Richard H. Aldrich, 617-576-3111, vice president of Vertex; 
or . . . 



20/3, K/3 (Item 1 from file: 636) 

DIALOG (R) File 636:Gale Group Newsletter DB(TM) 
(c) 2004 The Gale Group. All rts. reserv. 

:;^0S270I Supplier Number: 78375441 {USE FORMAT 7 FOR FULLTEXT) 
Right Vision introduces new version of Eye-box ONE. (Brief Article) (Product 
Announcement) 

Incernet Business News, pNA 
Sept 18, 2001 

Language: English Record Type: Fulltext 
Article Type: Brief Article Product Announcement 
Document Type: Magazine/ Journal ; Trade 
Word Count: 176 

... of a single box containing different modules that can be activated 

when needed. The modules correspond to specific Internet applications 

- such as web site hosting, e-mail, firewall and virtual private 
networks. Additional modules, for anti - virus protection for instance, 
can now also be purchased. 

The new version comes with a step. . . 



20/3, K/4 (Item 2 from file: 636) 

DIALOG (R) File 636:Gale Group Newsletter DB(TM) 
(c) 2004 The Gale Group. All rts. reserv. 

05081739 Supplier Number: 78375424 (USE FORMAT 7 FOR FULLTEXT) 
Right Vision introduces new version of Eye-box ONE. (Eye-box ONE 2.5 network 
management software) (Brief Article) (Product Announcement) 

Telecomworldwire, pNA 
Sept 18, 2001 

Language: English Record Type: Fulltext 
Article Type: Brief Article Product Announcement 
Document Type: Newsletter; Trade 
Word Count : 189 

... of a single box containing different modules that can be activated 

when needed. The modules correspond to specific Internet applications 

- such as web site hosting, e-mail, firewall and virtual private 
necworks. Additional modules, for anti - virus protection for instance, 
can now also be purchased. 

The new version comes with a step. . . 



20/3, K/5 (Item 1 from file: 16) 

DIALOG (R) File 16: Gale Group PROMT (R) 

(c) 2004 The Gale Group. All rts. reserv. 

06059246 Supplier Number: 55349539 (USE FORMAT 7 FOR FULLTEXT) 
In Search of Integrated Management. (Unicenter TNG, from Computer Associates 
leads in enterprise management solution race) (Product Information) 

Steinke, Steve 
Network, pNA 
Dec 1, 1998 

Ldnquaqe: English Record Type: Fulltext Abstract 
i'ocumeni: Type: Magazine/ Journal ; Trade 
rd Cou n c : 3355 

Che definition of business-process views, a select grouping of 
devices and processes that is associated with a particular business 
process . Depending on the degree of instrumentation installed on the 
individual objects, business-process views may. . . 

...help desk product; ControlIT, a remote control product (formerly known 
as Remotely Possible); InoculatelT, an anti - virus tool (formerly 
Inoculan); and NetworkIT, an IP/IPX network manager. 
The IT series of products... 



20/3, K/6 (Item 2 from file: 16) 

DIALOG (R) File 16:Gale Group PROMT (R) 

(c) 2004 The Gale Group. All rts. reserv. 

04438109 Supplier Number: 46512710 (USE FORMAT 7 FOR FULLTEXT) 
MicroHelp rushes toward compression utility market with Zip 

InfoWorld, p090 
July 1, 1996 

Language: English Record Type: Fulltext 
Document Type: Magazine/ Journa 1 ; Trade 
Word Count : 737 

or WinZip that I especially like is it lets you run external 
_r:--::3;ns, .such as virus detectors and other archives. This feature 
r*':S"'u exisu in MicroHelp Zip -- or in Zip-It... 

...text file that doesn't have an extension or a file whose extension is 
not associated with a specific program . 

MicroHelp Zip does include password protection, but the manual makes 



-ncrypcion scheme sound as. 



20/3, K/7 (Item 1 from file: 148) 

DIALOG (R) File 148:Gale Group Trade & Industry DB 
(c)2004 The Gale Group. All rts. reserv. 

09048511 SUPPLIER NUMBER: 18741073 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

MicroHelp gets a base hit for its compression software. (Zip) (Software 
Review) (Evaluation) (Brief Article) 

Byrne, Jason 

Government Computer News, vl5, n24, p38(l) 
Sep 23, 1996 

DOCUMENT TYPE: Evaluation Brief Article ISSN: 0738-4300 

LANGUAGE: English RECORD TYPE: Fulltext 

WORD COUNT: 406 LINE COUNT: 00035 

... the file back together. 

Another complication is the inability to run external programs such 
as virus scanners in tandem. This hampers Zip's effectiveness for 
handling Internet files. 

Must match 

Viewers are . . . 

...TXT but it's hardly useful otherwise. The same holds true for any file 
not associated with a particular program . 

T found the interface easy to move through, and compression novices 

. . .j f i r:ri i u hard . . . 



20/3, K/8 (Item 2 from file: 148) 

DIALOG (R) File 148:Gale Group Trade & Industry DB 
(c)2004 The Gale Group. All rts. reserv. 

08818516 SUPPLIER NUMBER: 18447202 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

MicroHelp rushes toward compression utility market with Zip. (MicroHelp Zip 
compression software for Windows) (Software Review) (Evaluation) 

Peschel, Joe 

InfoWorld, vlB, n27, p90{l) 
July 1, 1996 

DOCUMENT TYPE: Evaluation ISSN: 0199-6649 LANGUAGE: English 

RECORD TYPE: Fulltext; Abstract 

WORD COUNT: 769 LINE COUNT: 00063 

... of WinZip that I especially like is it lets you run external 

programs, such as virus detectors and other archives. This feature 
doesn't exist in MicroHelp Zip — or in Zip-It... 

...text file that doesn't have an extension or a file whose extension is 
not associated with a specific program . 

MicroHelp Zip does include password protection, but the manual makes 
che encryption scheme sound as.., 

20/3, K/9 (Item 3 from file: 148) 

■ ^ ^' r<) rile 148:Gale Group Trade & Industry DB 
' :,2^roA The Gale Group. All rts. reserv. 

05577467 SUPPLIER NUMBER: 11794018 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

Free and User Supported Software for the IBM PC: A Resource Guide for 
Libraries and Individuals, (book reviews) 

Grosch, Audrey N. 

Library Software Review, vlO, n6, p401(l) 
Nov-Dec, 1991 

DOCUMENT TYPE: review ISSN: 0742-5759 LANGUAGE: ENGLISH 

RECORD TYPE: FULLTEXT 

WORD COUNT: 455 LINE COUNT: 00035 



will find excellent collections of free and user-3i^Dorted software 
from reputable system operators who virus /operationally check their 
offerings or obtain them from the major electronic network distribution 
sources. In addition to the above SDN, there is the Software Distribution 
Service (SDS) , WinNET for Windows- specific programs , and DvNET for 
DesQview- related programs . Ask your sysop about these as secure sources 
of this software. The authors would be... 



20/3, K/10 (Item 4 from file: 148) 

DIALOG (R) File 148: Gale Group Trade & Industry DB 
(c)2004 The Gale Group. All rts. reserv. 

03940947 SUPPLIER NUMBER: 07673495 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

The use of purified clotting factor concentrates in hemophilia. 

Pierce, Glenn F. ; Lusher, Jeanne M.; Brownstein, Alan P.; Goldsmith, 
Jonachan C; Kessler, Craig M. 

JAMA, The Journal of the American Medical Association, v261, n23, p3434{5) 
June 16, 1989 

ISSN: 0098-74 84 LANGUAGE: ENGLISH RECORD TYPE: FULLTEXT; ABSTRACT 

Wnpr; COUNT: 4 577 LINE COUNT: 00394 

. . . wi'ch uncreated or some dry-heated clotting factor concentrates 

.'.-nble !). Viral transmission is also related to other, less-well-studied 
ioccors specific to manufacturing processes as well as to the 
concentration of virus in the donor plasma pool and the... 

...Table 2). In particular, the physical state of the clotting factor (dry, 
liquid) during the viral inactivation process affects kill of virus 
(Table 2) . Products with lower specific activities, products heated to 
lower temperatures for less time... 

...viruses. Therefore, the appropriate balance must be addressed between 
acceptable destruction of product and complete elimination of live virus 
. Informative data on the effects of stabilizers on viral kill and protein 
yield are considered. . . 
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?) 
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513 21 RD (unique items) 

514 . : 19^ S13 NOT (S9 OR PY=2001 : 2004 ) 



14/5/3 (Item 1 from l|ie: 202) 

DIALOG (R) File 202:Info. Sci . & Tech. Abs . 
(c) 2004 EBSCO Publishing. All rts. reserv. 

2604297 

Implementing optical storage. 

Author(s): O'Connor, MA 
Optical Information Systems vol. 11, no. 1, pages 39-41 
Publication Date: Jan 1991 
ISSN: 0886-5809 
Language : English 
Document Type: Journal Article 
Record Type: Abstract 
lournal Announcement: 2600 

This article describes the uses of optical storage devices, and discusses 
how to implement specific applications. The author explores the various 
types of optical storage and the range of applications appropriate to each. 
WORM , erasable, interactive videodisc, and optical memory card are 
studied. Issues associated with implementing optical technology are 
reviewed including issues associated with capture or conversion of data, 
and issues associated with specific database applications . 

Descriptors: Disk storage; Optical disks 
Classification Codes and Description: 5.07 {Storage) 
Main Heading: Information Processing and Control 




14/5/4 (Item 1 from file: 233) 

DIALOG (R) File 233: Internet & Personal Comp. Abs. 
(c) 2003 EBSCO Pub. All rts. reserv. 

00291764 92PX10-024 

Norton Desktop for Windows 

Law, Greg 

PCM , October 1, 1992 , vlO n4 plO-12, 16, 3 Page{s) 
ISSN: 0747-0460 

Product Name: Norton Desktop for Windows 

Languages: English 

Document Type: Software Review 

Grade (of Product Reviewed) : B 

Hardware/Software Compatibility: Microsoft Windows 
Geographic Location: United States 

WORKING IN WINDOWS column presents a favorable review of Norton Desktop 
for Windows v. 2.0 {$NA), a user interface from Norton Utiliare of 
Pittsburgh, PA (412). Requires 8.5MB disk space. Says this program is a 
replacement for both the Windows Program Manager and File Manager. 
Installation is straightforward and easy. Supports most functions of File 
Manager and Program Manager and includes Norton Anti- Virus , Desktop 
Editor, Sleeper, Norton Disk Doctor, Scheduler, Norton Viewer, SuperFind, 
Smart Erase, Icon Editor, Syslnfo, Batch Runner, Batch Builder, Macro 
Builder, Financial, Scientific, and Tape Calculators, Diskcopy, Key Finder, 
Format Disk, Shredder, and Norton Backup. Is better at copying and moving 
files and supports drag-and-drop techniques better than both Program 
Mrjnaqer and File Manager. Can print files not associated with specific 
applications . Its best feature is that it is extendible. Contains six 
'rp-'^n displays, (vl) 



